CVE-2025-8479

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L144
• https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L151
• https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.2/settings.php#L144
• https://www.wordfence.com/threat-intel/vulnerabilities/id/328fc7a9-be41-4e30-bb8d-c12ac3fd63f5?source=cve

Published

Sep 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8472Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Rem…7.4
• CVE-2025-8473Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulner…6.6
• CVE-2025-8474Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Exec…6.8
• CVE-2025-8475Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code…7.4
• CVE-2025-8476Alpine iLX-507 TIDAL Improper Certificate Validation Vulnera…8
• CVE-2025-8477Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Rem…7.4
• CVE-2025-8480Alpine iLX-507 Command Injection Remote Code Execution. This…8
• CVE-2025-8481The Blog Designer For Elementor – Post Slider, Post Carousel…4.3
• CVE-2025-8482The Simple Local Avatars plugin for WordPress is vulnerable …4.3
• CVE-2025-8483The The Discussion Board – WordPress Forum Plugin plugin for…6.3
• CVE-2025-8484The Code Quality Control Tool plugin for WordPress is vulner…5.3
• CVE-2025-8485An improper permissions vulnerability was reported in Lenovo…7.3